Examkin

Question

Difficulty: HardMulti-Account Governance and Organizational Structure

A multinational corporation is designing its AWS multi-account governance strategy using AWS Organizations. The organizational structure has a Workloads Organizational Unit (OU) containing separate Production and Non-Production child OUs. The security team requires that AWS CloudTrail and AWS Config remain enabled and unaltered across all member accounts within the Workloads OU. Additionally, developers operating in these accounts must be prevented from deleting or modifying a centralized IAM role named SecurityComplianceRole. However, a central deployment pipeline that assumes an IAM role named PipelineExecutionRole in each member account must be permitted to modify these governance resources and update the SecurityComplianceRole during scheduled deployments. Which of the following governance strategies should a solutions architect recommend to meet these requirements with the least administrative effort?

  1. Apply a Service Control Policy (SCP) at the Workloads OU level that denies iam:* actions targeting the SecurityComplianceRole, and config:* and cloudtrail:* write actions. Add a Condition to the SCP that exempts the principal ARN of the PipelineExecutionRole from the Deny rule. Rely on local IAM policies in the member accounts to grant developers their necessary daily operational permissions.Answer
  2. B
    Apply a Service Control Policy (SCP) at the Workloads OU level that contains Allow statements permitting iam:* actions on the SecurityComplianceRole, and config:* and cloudtrail:* actions only for the PipelineExecutionRole. Rely on the SCP's Allow statements to automatically provision the necessary administrative permissions to developers in the member accounts without local IAM policies.
  3. C
    Configure cross-account access by modifying the trust policy of the SecurityComplianceRole in each member account to trust the central pipeline. To simplify administration, omit the sts:AssumeRole action from the trust policy, and instead use local IAM group policies in the member accounts to grant the PipelineExecutionRole the authority to manage the SecurityComplianceRole.
  4. D
    Configure CloudTrail and AWS Config in the member accounts to log to a centralized S3 bucket in the Security account. Enforce this via an SCP at the Workloads OU level, but use the default S3 bucket policy in the Security account, relying on the member accounts' inclusion in the AWS Organization to automatically inherit write permissions to the centralized bucket.

Answer

Apply a Service Control Policy (SCP) at the Workloads OU level that denies modification of the SecurityComplianceRole, AWS Config, and CloudTrail, while using a Condition to exempt the PipelineExecutionRole. Local IAM policies must be configured in member accounts to grant developers their permissions.
The correct strategy uses an SCP at the Workloads OU level to restrict modifications of AWS Config, AWS CloudTrail, and the specific SecurityComplianceRole. By adding a condition that checks the 'aws:PrincipalARN' and exempts the PipelineExecutionRole ARN, the security team ensures the pipeline can perform updates while blocking developers and local administrators. Local IAM policies are still used to grant developers their daily operational permissions, as SCPs are guardrails that limit the maximum available permissions rather than granting them.

Step-by-Step Solution

1
Analyze the requirements for restricting actions on CloudTrail, AWS Config, and the SecurityComplianceRole across all member accounts in the Workloads OU.
Identify that Service Control Policies (SCPs) attached to OUs are the most operationally efficient way to enforce organization-wide guardrails on all member account principals.
SCPs allow centralized restriction of actions across multiple accounts, preventing even local administrators from bypassing security controls.
2
Identify the exception requirement for the PipelineExecutionRole assumed by the central pipeline.
Determine that the SCP must include a condition block using the 'StringNotLike' operator for the 'aws:PrincipalARN' context key to exempt the PipelineExecutionRole ARN from the Deny actions.
This allows the pipeline to modify the restricted resources during deployments while blocking all other users, including local admins.
3
Evaluate the mechanism of SCPs versus local IAM policies.
Understand that SCPs act as guardrails (implicit deny / explicit deny overrides any allow) and do not grant permissions. Local IAM policies are still required to grant permissions.
This ensures the solution is secure and functions correctly, avoiding the misconception that SCPs grant permissions.

Key Concept

AWS Organizations Service Control Policies (SCPs) act as permission boundaries/guardrails rather than permission-granting mechanisms, and they can utilize condition keys like 'aws:PrincipalARN' to implement administrative exemptions.
Rate this question

Topics

Multi-Account Governance and Organizational Structure

More questions from this topic